Newsletters
The Enterprise Security Supersite NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
This ad will display for the next 20 seconds. Please click for more information, or scroll down to pass the ad, or Close Ad.
Home Network Security Viruses & Malware Hackers Security Solutions More Topics...
Vblock™ Systems:
Advanced converged infrastructure
increases productivity & lowers costs.

www.vce.com
Mobile Security
Tame your scariest paperwork. Find Out How
Average Rating:
Rate this article:  
Android Master Key Vulnerability Exploited in Two Apps
Android Master Key Vulnerability Exploited in Two Apps

By Seth Fitzgerald
July 24, 2013 10:39AM

Bookmark and Share
When Symantec first wrote about the Android "master key" flaw, which was identified by startup Bluebox Security, Google automatically released a patch to protect devices. While the patch protects Nexus devices, manufacturers still have to push out updates to non-Nexus phones, which could take months.
 


Symantec researchers say the first known use of the Android "master key" vulnerability has been found in the wild. Two applications distributed on unofficial Android marketplaces in China were found to be using the exploit.

When Symantec's team first discussed the vulnerability earlier this month, which was identified by startup Bluebox Security, they said they expected attackers to exploit it quickly because of its ease-of-use. They appear to have been right on the mark.

The two applications discovered in the marketplace were legitimate apps which are meant to help people find and make doctor appointments, however an attacker seems to have added code to the apps in order to make them exploit the Android master key vulnerability.

The Exploit

Both of the previously legitimate applications have been infected with additional code which allows the hacker to remotely control devices, access data, send premium SMS messages, and disable security features.

By using this vulnerability, the hacker modified the applications by adding a new classes.dex file which contains the code, as well as a new manifest file which specifies permissions.

The attackers ability to send out premium texts is one of the most concerning aspects of the exploit. Each premium text that is sent out because of this code will incur a charge, although all of the fees will be directed to the attacker and not to the carrier.

Difficulty Updating

When Symantec first announced that they had discovered this type of flaw, Google automatically released a patch which would protect devices. Even though the patch prevents Nexus devices against attacks, manufacturers still have to push out updates with the patch to non-Nexus phones.

The process of sending out updates can sometimes take months, no matter how important the update is to a device. Millions of Android devices either never receive updates or they receive very few updates, resulting in continuous vulnerabilities to many different attacks.

This type of delay has been one of the major criticisms of Android especially recently, and has resulted in many people praising Apple because of how fast and easily it is able to push out security updates to all of their devices.

Many users are now demanding that carriers and phone manufacturers find a new way of receiving and pushing out important security-based updates. Although design changes require a lot of custom tailoring to individual phones, security updates should take far less time to distribute.

Protecting Your Device

Since it could take months for a security update to be implement on all Android phones, there are a few ways to protect your device from attacks like this one.

Simply downloading Norton Security antivirus should keep any infected applications from harming your device. Another alternative is the Bluebox Security Scanner, which should also provide the necessary protection.

Users with a Nexus or Samsung device will have already had the patch sent out to their phone, but taking these precautions is important for users with any other type of device.
 

Tell Us What You Think
Comment:

Name:



APC has an established a reputation for solid products that virtually pay for themselves upon installation. Who has time to spend worrying about system downtime? APC makes it easy for you to focus on business growth instead of business downtime with reliable data center systems and IT solutions. Learn more here.


 Mobile Security
1.   Google Expands Virus Scans to All Apps
2.   Samsung Adding Anti-Theft Solutions
3.   Police Keep Quiet About Cell Tracking
4.   BlackBerry Wins Security Certification
5.   NSA Collects, Retrieves Foreign Calls


advertisement
Google Expands Virus Scans to All Apps
Not limited to Google Play apps anymore.
Average Rating:
Police Keep Quiet About Cell Tracking
Tool called Stingray remains a mystery.
Average Rating:
BlackBerry Wins Security Certification
Enterprise Service 10 gets FIPS nod.
Average Rating:


advertisement
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Tech Giants Fund Initiative To Prevent Future Heartbleeds
Can more funding prevent Heartbleed vulnerabilities in future open-source software? A new Core Infrastructure Initiative at the Linux Foundation is attempting to find out.
 
What Verizon's Data Breach Report Can Teach Enterprises
It’s probably not a jaw-dropper, but cyberespionage is officially on the rise. And the use of stolen or misused credentials is still the leading way the bad guys gain access to corporate information.
 
Top Cyberthreats Exposed by Verizon Report
Beyond Heartbleed, there are cyberthreats vying to take down enterprise networks, corrupt smartphones, and wreak havoc on businesses. Verizon is exposing these threats in a new report.
 

Navigation
Enterprise Security Today
Home/Top News | Network Security | Viruses & Malware | Hackers | Security Solutions | Mobile Security | Disaster Recovery | Windows Security
Data Security | EST Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters | XML/RSS Feed

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.